Yes, that's what I'm referring to with > I'm actually really curious about how the ITW exploit for this CVE worked It's really weird to see only a single OOB

Yes, that's what I'm referring to with > I'm actually really curious about how the ITW exploit for this CVE worked It's really weird to see only a single OOB write patched for a full 0-click chain in the wild - how did they get code execution? PAC+ASLR bypass? Sandbox escape/kernel escalation? Literally only RawCamera is patched in the update - were the other bugs in the chain already patched? Too difficult to patch immediately? (ie - close the front door while working on replacing the other locks?)? Still unknown? (ie - found a crash dump from RawCamera but didn't get as sample of the full chain?)